Yes, in two ways. It applies to any digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. A GCC processing foreign individuals' data under a contract with a foreign entity gets a partial exemption, but security safeguards still apply, and its own Indian employee and vendor data is fully covered.
The Act covers processing of digital personal data within India, whether collected digitally or digitised later. It also reaches processing outside India if it is connected with offering goods or services to Data Principals in India. A foreign company selling to Indian customers is in scope even with no Indian entity.
| Situation | DPDP treatment |
|---|---|
| Foreign company selling to people in India | In scope, even with no Indian entity |
| GCC processing foreign individuals' data for a foreign parent or client | Partial exemption; s.8(1) and s.8(5) security safeguards still apply |
| GCC's own Indian employees and candidates | Fully in scope |
| Transfer of data out of India | Permitted unless to a country the government restricts |
Where a person in India processes personal data of people outside India under a contract with a person outside India, most of the Data Fiduciary obligations do not apply. That is the typical GCC or outsourcing case.
Two things survive the exemption: the general duty to be responsible for compliance in section 8(1), and the duty in section 8(5) to take reasonable security safeguards to prevent a personal data breach. Failing at security is the most expensive line in the penalty schedule, at up to ₹250 crore.
A GCC's own staff, candidates, contractors and visitors are Data Principals in India, so that data gets full treatment. Employment purposes are one of the "legitimate uses" in section 7, so consent is not always needed, but notice, security, breach notification and retention duties still apply.
Cross-border transfers are allowed by default; the government can restrict transfers to notified countries. CERT-In's six-hour incident reporting under the IT Act applies separately and in parallel.
Board reporting, AI governance, DPDP readiness or CMMC. Tell me which and what the constraint is.
me@sarfarazchougule.com →